This vulnerability allows an attacker to set the Avro schema URL in a table definition, causing Impala to issue an HTTP GET request to any supplied host. The response can surface in parsing error messages, potentially leaking internal endpoint information. The weakness is a classic SSRF, identified as CWE‑918, which can enable attackers to probe or access services that Impala itself can reach, thereby compromising confidentiality and possibly enabling further exploitation.

Apache Impala versions 2.0.0 through 4.5.1 on all platforms are affected when a table is created or altered to include tblproperties('://…') or a file:/// URI. Systems running these Impala versions and hosting such tables are vulnerable.

The CVSS score is 5.3, and the EPSS score is < 1%, but the vulnerability is listed as not in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires the ability to create or modify a table to inject the schema URL, which is typically available to users with write access to the database. Once the property is set, Impala will automatically send the GET request, and error responses could reveal sensitive data, indicating a moderate potential impact if exploited. The low EPSS score suggests that exploitation is unlikely at present, but SSRF flaws are still considered high risk if exposed.